Virus Name: Timor
V Status: Rare
Discovery: April, 1992
Symptoms: .COM & .EXE file growth; TSR; message displayed on
Eff Length: 1,562 - 1,576 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, Sweep, ViruScan, IBMAV, PCScan,
AVTK, NAV, NAVDX, VAlert, ChAV,
NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N,
Removal Instructions: Delete infected files
The Timor virus was received in April, 1992. Its origin is
unknown. Timor is a memory resident infector of .COM and .EXE
programs, and is based on the Jerusalem virus.
When the first Timor infector program is executed, the Timor virus
will install itself memory resident as a low system memory TSR of
2,816 bytes. It will hook interrupts 21 and F8.
Once Timor is memory resident, it will infect .COM and .EXE
programs when they are executed. .COM programs will have a file
length increase of 1,562 bytes with the virus being located at the
beginning of the infected file. .EXE programs will have a file
length increase of 1,562 - 1,576 bytes with the virus being located
at the end of the infected file. Unlike Jerusalem, Timor does not
reinfect .EXE files. Infected programs will not have any change
to their date and time in the DOS disk directory.
The following text strings can be found in all Timor infected
"St Cruz, Dili"
"sso, Freedom for East Timor !"
"1991 Nov 12, Lusitâia Expres"
Timor activates on November 12th of any year, at which time it
may display the message: "St Cruz, Dili".